@agent-e/server 1.6.8 → 1.6.10

package/dist/index.js

@@ -569,7 +569,7 @@ function getDashboardHtml() {
   const $app = document.getElementById('app');
 
   // \u2500\u2500 Helpers \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
-  function esc(s) { return String(s).replace(/&/g,'&amp;').replace(/</g,'&lt;').replace(/>/g,'&gt;').replace(/"/g,'&quot;').replace(/'/g,'&#39;'); }
+  function esc(s) { return String(s).replace(/&/g,'&amp;').replace(/</g,'&lt;').replace(/>/g,'&gt;').replace(/"/g,'&quot;').replace(/'/g,'&#39;').replace(/\\\\/g,'&#92;'); }
   function pad(n, w) { return String(n).padStart(w || 4, ' '); }
   function fmt(n) { return typeof n === 'number' ? n.toFixed(3) : '\u2014'; }
   function pct(n) { return typeof n === 'number' ? (n * 100).toFixed(0) + '%' : '\u2014'; }
@@ -941,7 +941,7 @@ function getDashboardHtml() {
   window._approve = function(id) {
     postJSON('/approve', { decisionId: id }).then(function(data) {
       if (data.ok) {
-        addTerminalLine('<span class="t-tick">[Advisor]</span> <span class="t-ok">\\u2705 Approved ' + id + '</span>');
+        addTerminalLine('<span class="t-tick">[Advisor]</span> <span class="t-ok">\\u2705 Approved ' + esc(id) + '</span>');
       }
     }).catch(function() {});
   };
@@ -950,7 +950,7 @@ function getDashboardHtml() {
     var reason = prompt('Rejection reason (optional):');
     postJSON('/reject', { decisionId: id, reason: reason || undefined }).then(function(data) {
       if (data.ok) {
-        addTerminalLine('<span class="t-tick">[Advisor]</span> <span class="t-fail">\\u274c Rejected ' + id + '</span>');
+        addTerminalLine('<span class="t-tick">[Advisor]</span> <span class="t-fail">\\u274c Rejected ' + esc(id) + '</span>');
       }
     }).catch(function() {});
   };
@@ -977,14 +977,30 @@ function setSecurityHeaders(res) {
   res.setHeader("X-Frame-Options", "DENY");
   res.setHeader("Referrer-Policy", "strict-origin-when-cross-origin");
 }
-function setCorsHeaders(res, origin) {
+function setCorsHeaders(res, allowedOrigin, requestOrigin) {
   setSecurityHeaders(res);
+  const origin = allowedOrigin === "*" ? "*" : requestOrigin === allowedOrigin ? allowedOrigin : allowedOrigin;
   res.setHeader("Access-Control-Allow-Origin", origin);
   res.setHeader("Access-Control-Allow-Methods", "GET, POST, OPTIONS");
-  res.setHeader("Access-Control-Allow-Headers", "Content-Type");
+  res.setHeader("Access-Control-Allow-Headers", "Content-Type, Authorization");
 }
-function json(res, status, data, origin) {
-  setCorsHeaders(res, origin);
+function sanitizeJson(obj) {
+  if (obj === null || typeof obj !== "object") return obj;
+  if (Array.isArray(obj)) return obj.map(sanitizeJson);
+  const clean = {};
+  for (const [key, val] of Object.entries(obj)) {
+    if (key === "__proto__" || key === "constructor" || key === "prototype") continue;
+    clean[key] = sanitizeJson(val);
+  }
+  return clean;
+}
+function checkAuth(req, apiKey) {
+  if (!apiKey) return true;
+  const header = req.headers["authorization"];
+  return header === `Bearer ${apiKey}`;
+}
+function json(res, status, data, origin, reqOrigin) {
+  setCorsHeaders(res, origin, reqOrigin);
   res.writeHead(status, { "Content-Type": "application/json" });
   res.end(JSON.stringify(data));
 }
@@ -1007,6 +1023,7 @@ function readBody(req) {
 }
 function createRouteHandler(server) {
   const cors = server.corsOrigin;
+  const apiKey = server.apiKey;
   return async (req, res) => {
     const url = new URL(req.url ?? "/", `http://${req.headers.host ?? "localhost"}`);
     const path = url.pathname;
@@ -1019,10 +1036,14 @@ function createRouteHandler(server) {
     }
     try {
       if (path === "/tick" && method === "POST") {
+        if (!checkAuth(req, apiKey)) {
+          json(res, 401, { error: "Unauthorized" }, cors);
+          return;
+        }
         const body = await readBody(req);
         let parsed;
         try {
-          parsed = JSON.parse(body);
+          parsed = sanitizeJson(JSON.parse(body));
         } catch {
           json(res, 400, { error: "Invalid JSON" }, cors);
           return;
@@ -1093,10 +1114,14 @@ function createRouteHandler(server) {
         return;
       }
       if (path === "/config" && method === "POST") {
+        if (!checkAuth(req, apiKey)) {
+          json(res, 401, { error: "Unauthorized" }, cors);
+          return;
+        }
         const body = await readBody(req);
         let parsed;
         try {
-          parsed = JSON.parse(body);
+          parsed = sanitizeJson(JSON.parse(body));
         } catch {
           json(res, 400, { error: "Invalid JSON" }, cors);
           return;
@@ -1113,6 +1138,7 @@ function createRouteHandler(server) {
           }
         }
         if (Array.isArray(config["constrain"])) {
+          const validated = [];
           for (const c of config["constrain"]) {
             if (c && typeof c === "object" && typeof c["param"] === "string" && typeof c["min"] === "number" && typeof c["max"] === "number") {
               const constraint = c;
@@ -1124,9 +1150,12 @@ function createRouteHandler(server) {
                 json(res, 400, { error: "Constraint min cannot exceed max" }, cors);
                 return;
               }
-              server.constrain(constraint.param, { min: constraint.min, max: constraint.max });
+              validated.push(constraint);
             }
           }
+          for (const constraint of validated) {
+            server.constrain(constraint.param, { min: constraint.min, max: constraint.max });
+          }
         }
         if (config["mode"] === "autonomous" || config["mode"] === "advisor") {
           server.setMode(config["mode"]);
@@ -1148,10 +1177,14 @@ function createRouteHandler(server) {
         return;
       }
       if (path === "/diagnose" && method === "POST") {
+        if (!checkAuth(req, apiKey)) {
+          json(res, 401, { error: "Unauthorized" }, cors);
+          return;
+        }
         const body = await readBody(req);
         let parsed;
         try {
-          parsed = JSON.parse(body);
+          parsed = sanitizeJson(JSON.parse(body));
         } catch {
           json(res, 400, { error: "Invalid JSON" }, cors);
           return;
@@ -1202,10 +1235,14 @@ function createRouteHandler(server) {
         return;
       }
       if (path === "/approve" && method === "POST") {
+        if (!checkAuth(req, apiKey)) {
+          json(res, 401, { error: "Unauthorized" }, cors);
+          return;
+        }
         const body = await readBody(req);
         let parsed;
         try {
-          parsed = JSON.parse(body);
+          parsed = sanitizeJson(JSON.parse(body));
         } catch {
           json(res, 400, { error: "Invalid JSON" }, cors);
           return;
@@ -1241,10 +1278,14 @@ function createRouteHandler(server) {
         return;
       }
       if (path === "/reject" && method === "POST") {
+        if (!checkAuth(req, apiKey)) {
+          json(res, 401, { error: "Unauthorized" }, cors);
+          return;
+        }
         const body = await readBody(req);
         let parsed;
         try {
-          parsed = JSON.parse(body);
+          parsed = sanitizeJson(JSON.parse(body));
         } catch {
           json(res, 400, { error: "Invalid JSON" }, cors);
           return;
@@ -1308,6 +1349,16 @@ function send(ws, data) {
     ws.send(JSON.stringify(data));
   }
 }
+function sanitizeJson2(obj) {
+  if (obj === null || typeof obj !== "object") return obj;
+  if (Array.isArray(obj)) return obj.map(sanitizeJson2);
+  const clean = {};
+  for (const [key, val] of Object.entries(obj)) {
+    if (key === "__proto__" || key === "constructor" || key === "prototype") continue;
+    clean[key] = sanitizeJson2(val);
+  }
+  return clean;
+}
 function createWebSocketHandler(httpServer, server) {
   const wss = new import_ws.WebSocketServer({ server: httpServer, maxPayload: MAX_WS_PAYLOAD });
   const aliveMap = /* @__PURE__ */ new WeakMap();
@@ -1323,13 +1374,22 @@ function createWebSocketHandler(httpServer, server) {
       }
     }
   }, 3e4);
-  wss.on("connection", (ws) => {
+  wss.on("connection", (ws, req) => {
     if (wss.clients.size > MAX_WS_CONNECTIONS) {
       ws.close(1013, "Server at capacity");
       return;
     }
+    if (server.apiKey) {
+      const url = new URL(req.url ?? "/", `http://${req.headers.host ?? "localhost"}`);
+      const token = url.searchParams.get("token") ?? req.headers["authorization"]?.replace("Bearer ", "");
+      if (token !== server.apiKey) {
+        ws.close(1008, "Unauthorized");
+        return;
+      }
+    }
     console.log("[AgentE Server] Client connected");
     aliveMap.set(ws, true);
+    let lastTickTime = 0;
     ws.on("pong", () => {
       aliveMap.set(ws, true);
     });
@@ -1339,7 +1399,7 @@ function createWebSocketHandler(httpServer, server) {
     ws.on("message", async (raw) => {
       let msg;
       try {
-        msg = JSON.parse(raw.toString());
+        msg = sanitizeJson2(JSON.parse(raw.toString()));
       } catch {
         send(ws, { type: "error", message: "Malformed JSON" });
         return;
@@ -1350,6 +1410,12 @@ function createWebSocketHandler(httpServer, server) {
       }
       switch (msg.type) {
         case "tick": {
+          const now = Date.now();
+          if (now - lastTickTime < MIN_TICK_INTERVAL_MS) {
+            send(ws, { type: "error", message: "Rate limited \u2014 min 100ms between ticks" });
+            break;
+          }
+          lastTickTime = now;
           const state = msg["state"];
           const events = msg["events"];
           if (server.validateState) {
@@ -1429,7 +1495,7 @@ function createWebSocketHandler(httpServer, server) {
           break;
         }
         default:
-          send(ws, { type: "error", message: `Unknown message type: "${msg.type}"` });
+          send(ws, { type: "error", message: `Unknown message type: "${String(msg.type).slice(0, 100)}"` });
       }
     });
   });
@@ -1449,7 +1515,7 @@ function createWebSocketHandler(httpServer, server) {
     broadcast
   };
 }
-var import_ws, import_core2, MAX_WS_PAYLOAD, MAX_WS_CONNECTIONS;
+var import_ws, import_core2, MAX_WS_PAYLOAD, MAX_WS_CONNECTIONS, MIN_TICK_INTERVAL_MS;
 var init_websocket = __esm({
   "src/websocket.ts"() {
     "use strict";
@@ -1457,6 +1523,7 @@ var init_websocket = __esm({
     import_core2 = require("@agent-e/core");
     MAX_WS_PAYLOAD = 1048576;
     MAX_WS_CONNECTIONS = 100;
+    MIN_TICK_INTERVAL_MS = 100;
   }
 });
 
@@ -1481,7 +1548,8 @@ var init_AgentEServer = __esm({
         this.startedAt = Date.now();
         this.wsHandle = null;
         this.port = config.port ?? 3100;
-        this.host = config.host ?? "0.0.0.0";
+        this.host = config.host ?? "127.0.0.1";
+        this.apiKey = config.apiKey;
         this.validateState = config.validateState ?? true;
         this.corsOrigin = config.corsOrigin ?? "http://localhost:3100";
         this.serveDashboard = config.serveDashboard ?? true;